Virus Database

Hallochen.a

Description Hallochen.a

It is a dangerous memory resident parasitic virus. It hooks INT 8, 16h, 21h and writes itself to the end of COM and EXE files. While infecting the COM files the virus also writes to the beginning of the files six bytes of the Jmp-Virus code:
JMP Loc_Virus
DB ?
DW 5555h

Depending on its "generation" the virus "jokes" with the keyboard, periodically it changes the keys that are entered. The virus also slows down the computer by delay on INT 8 (timer) calls.
The virus contains the text:
Hallöchen !!!!!!, Here I'm Acrivate Level 1

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Uglykid

Description Macro.Word.Uglykid

This is a polymorphic Word macro virus. It contains one macro in documents: AutoOpen, and two macros in NORMAL.DOT: FileSave, ToolsMacro. The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved (FileSave).
The virus uses quite complex polymorphic engine - different infected files have variable sets of commands in virus' macros. The virus also uses quite complex way to hide its main code in documents and templates: the main virus code is placed in AutoText area and virus' macros just read it from there, copy the text to macros area and execute it. This is the first known virus that uses such way to hide itself.
The virus sets the user's name to "Nasty". The polymorphic engine has bugs, as a result it may produce corrupted code.

Macro.Word.Uhrjap family

Description Macro.Word.Uhrjap family

These macro viruses contain different number of macros:
"Uhrjap.a": one, DelNew, autoopen, autoclose, normclose
"Uhrjap.b": Eee, autoclose, ToolsMacro, FileTemplates, ToolsCustomize,
Oao, autoopen.

They infect the global macros area on opening an infected document. Other documents get infection on closing.
"Uhrjap.b" is the stealth virus: on entering the Tools/Macro, Tools/Customize or File/Templates menus the virus removes its macros from a document, and as a result its code is not visible in macro viewing menus.
The viruses have destructive payload. "Uhrjap.a" on each 20'th opening starts a procedure that every 10 minutes counts the characters in the document. If the count it the same (haven't changes during 10 minutes), the virus renames all files in the root directory and first level directories on the C:, D: and E: drives with the names "~TLPxxx.TMP", where "xxx" is ordinal number of file in a directory. The virus also runs this renaming procedure with probability 2% on any document opening.
The "Uhrjap.b" virus on document opening or closing with probability 1/30 saves document with new password "uhrjap-uhrjap", or prints document, or deletes from document all space characters and replaces all digits with the "#" character. It also with probability 1/50 activates its payload procedure that is similar with "Uhrjap.a" virus: it renames all files in the root directory and first level directories on the C:, D: and E: drives with the name "~037xxx.TMP" where "xxx" is ordinal number of file in a directory.

Home